5. DISCLOSURES OF YOUR PERSONAL DATA  
 

We also may share your personal data with the parties set out below for the purposes set out in the table “Purposes for which we will use your personal data” above. 

​

• External Third Parties: these are companies who provide services to us and who may process your personal information based solely on the instructions they receive from us. For example, IT providers and companies that host our platforms and   
keep them secure.

 

• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use   
your personal data in the same way as set out in this privacy policy.

​

• Companies within our Group: Quint Group Limited 
• Any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights,   
or (iii) to protect your vital interests or those of any other person;  

​

6 INTERNATIONAL TRANSFERS  
 

Your personal information is stored on our secure servers in the UK. We do not transfer your personal data outside the UK.  

​

7 DATA SECURITY  
 

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees,   
agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.   

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Our security measures include encryption of data in transit and at rest using industry standard protocols, access controls with role-based permissions, regular security assessments and penetration testing, staff training on data protection, and incident response procedures.

​

8 DATA RETENTION  

The amount of time we hold your information depends on the reason it was provided. Your data will not be kept indefinitely and will only be kept for as long as is required for legitimate business reasons (for example to provide you with our Services or for the other reasons we explained above) and in order for us to comply with our legal and regulatory obligations.  

The personal information we receive when you make an application (whether on our website or which comes to us via one of the websites of our affiliates) is kept for a minimum of six years, which will commence at the end of the relationship. We are   
required to do so to ensure that if any disputes or complaints are raised, we have your information to enable us to address the complaints or disputes.  

To request details relating to your personal data retention, please use the contact details here.  

Specific retention periods for different categories of personal data are as follows:   
Identity verification data - 6 years from end of relationship; Credit assessment data - 6 years from assessment date; Fraud prevention data - 6 years from detection; Marketing data - 3 years from last interaction; Website analytics data - 2 years from collection. These periods comply with our legal and regulatory obligations under financial services legislation.

​

9 YOUR LEGAL RIGHTS  
You have the following legal rights regarding the processing of your personal data:  

The right to be informed  
You have a right to be informed about how your personal data is processed in a concise, transparent, intelligible and easily accessible manner, written in clear and plain language, that is free of charge. This is the purpose of this Privacy Policy.

The right of access  
You have the right to obtain confirmation that your data is being processed and to have access to that personal data. You can request this using the contact details here.  

The right to rectification  
You have the right to have your personal data rectified if it is incorrect or incomplete and we must notify any third parties that we have shared your data to do the same. 

 

You can request this using the contact details here.  

​

The right to erasure  
You have a “right to be forgotten”, or to have your personal data erased and to prevent processing. The right is not absolute and in certain circumstances this may not be possible (for example where we have to keep your personal data for legal or regulatory reasons). We must notify any third parties that have been shared your data of your request. You can request this using the contact details here.  

 
The right to restrict processing  
You have the right to ‘block’ or suppress the processing of your personal data. This does not stop the storing of your personal data, as it may be required to restrict processing in the future. We must notify any third parties that have shared your data of   
your request. You can request this using the contact details here.    

The right to data portability  
You have the right to obtain and reuse your personal data for your own purposes across different services in a safe and secure way, without hindrance to usability. You can request this using the contact details here.   

The right to object  
You have the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling); direct marketing (including profiling); and processing for purposes of scientific/historical research and statistics. You can request this using contact details here. 

​

Rights in relation to automated decision making and profiling

You have a right to object to automated decision making, to express your point of view, ask for human intervention, and to be provided with an explanation of the decision with your option to challenge it. You can request this using the contact details here.  

 

The right to withdraw consent

If you have given us explicit consent to process your personal data you have a right to withdraw that consent at any time, including but not limited to the removal of consent to be contacted for marketing purposes. You can request this using the contact details here.  

 

The right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with us directly and / or with a supervisory authority. In the UK the relevant authority is the Information Commissioner’s Office (ICO). You can find their contact details here. To exercise this right, please contact our DPO at dpo@infinian.co.uk or write to us at the address provided in 1. We will respond within one month and may request identity verification for security purposes.

 

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

 

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who does not have a right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

 

Time limit to respond

We aim to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or if you have made a number of requests. In this case, we will notify you and keep you updated.

 

Glossary

Customers means the third parties listed or described in “How we use your personal data” (above) who use Infinian’s products and services

 

Data Suppliers means third party data suppliers in the consumer credit industry and digital marketing companies serving that sector, namely Monevo Limited, Choose Wisely Limited, Comparitec Limited, and Credit Technologies Limited

 

External Third Parties

• Service providers acting as processors who provide IT and system administration services.

• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.

• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.

 

Lawful Basis

Legitimate interest means the interest of Infinian in conducting and managing its business to enable us to give our Customers the best services or products and the best and most secure experience. We make sure we consider and balance any potential impact on you as an individual (both positive and negative) and your rights before we process your personal data for a legitimate interest. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interest against any potential impact on you in respect of specific activities by contacting us. A legitimate interest may include legitimate business interests which provide a societal benefit, such as preventing fraud, protecting vulnerable customers, crime prevention and detection.

 

Compliance with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that Infinian is subject to.